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DETAILED ACTION 

1 . The text of those sections of Title 35,U.S.Code not included in this section can be 
found in the prior office action. 

2. The prior office actions are incorporated herein by reference. In particular, the 
observations with respect to claim language, and response to previously presented 
arguments. 

3. Claims 1-27 are pending. 

Response to Arguments 

4. Applicant's arguments in the light of limitations of the claims 4, 12, 18 and 24 
have been persuasive and the rejection of those claims have been withdrawn (see last 
paragraph below). 

5. Applicant's arguments filed 10/12/2005 have been fully considered but they are 
not persuasive with respect to claims 1-3, 5-11, 13-17, 19-23 and 25-27. 

• Examiner has fully considered Applicant's interpretation of Chen et al (5,832,208 
A) teaching (page 9-1 1 of the response). 

• As per Applicant's arguments requesting Examiner answers the questions raised 
by applicant, Examiner makes the following remarks: 
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1 ) with respect to the question number 1 , examiner refers Applicant to the facts that 
Chen clearly and explicitly disclose the term "e-mail message" is used for 
convenience and it is used to describe all types of files , including messages, 
broadcasts and communications used within, sent from or received by a mail server, 
it aiso disclose agent 110 do intercept and scan ali incoming files in order to 
give virus protection (see col.6, lines 54-63). Therefore Applicant's perception of an 
example of e-mail system of Chen and ignoring the other options presented by chen 
do not expedite the process of prosecution. 

2) It also disclose agent 110 do Intercept and scan all incoming files in order to 
give virus protection (see col.6, lines 54-63). 

• As per applicant's arguments with respect to independent claims 1 , 1 0, 16 and 
22 that Chen et al do not disclose "intercepting incoming files before they reach a 
file system" page 10 line 1 of the response; and "intercepting incoming files 
before they are transferred to a file system" page 1 1 , lines 12-13 of the response 
excluding spaces between the lines, examiner refers applicant to the following 
remarks: 

d) in order to emphasize why Chen et al disclose the above limitations examiner 
break the above limitation into two phrases in order to simplify the arguments. 

1) The phrase « intercepting incoming files » clearly indicate that action of 
interception is being done on incoming files, therefore the question is when Chen do 
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disclose the act of interception on incoming files. Applicant's arguments on page 9, 
last paragraph, page 10, lines 1-14 of the applicant's prior response implies that 
Applicant agrees that act of interception is being done by agent 1 10 but disagrees of 
when such act is being done. That's why Applicant has highlighted the phrase 
"before" to emphasize on the timing of the interception and not the act itself. 
Therefore Chen do disclose the act of interception of files as demonstrated on col .6, 
lines 54-58 where all types of files, messages, broadcasts and communications are 
being scanned by agent 1 10; or col.7, lines 32-35 where agent 110 monitors files for 
any type of attachments; agent 1 1 0 corresponds to Applicant's interceptor as 
interpreted by examiner in the last office action. 

2) The question of timing of when the interception is being done is disputed by 
Applicant, where Applicant argues that Chen do not disclose interception of files 
before they reach a file system (emphasized added). 

Examiner refers Applicant to Chen et al. col.6, lines 58-63 where "e-mail 
messages" is being used to describe all types of files, messages, broadcasts and 
communications used within, sent from or received by a mail server. Therefore 
Examiner considers any reference to e-mail messages corresponds to incoming files 
of Applicant's claims limitations. As an example" scanning of all e-mail messages 
corresponds to scanning of all incoming files as it was recited in the non-final office 
action. 
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Chen et al. col. 5, lines 54-56 refer to centralized virus detection operations at the 
server level. Therefore Examiner considers any reference to e-mail server or other 
name server by Chen et al corresponds to "networked server"' of Applicant's claim 
limitation as it was recited in the non-final office action. 

Applicant's claim language state interception before files are transferred to a file 
system of the server. Chen et al disclose on col. 6, lines 54-61 and fig.2 
interception of files sent to mail server by agent 110 

Chen et al abstract disclose interception of files for virus detection before 
being transferred to the message system (file system). Chen discloses "the agent 
is located at the server computer and provide an interface between the anti-virus 
module and the message system". Therefore any message received by the 
server is subjected to virus detection by the agent 1 10 and then be received by 
the message system or file system. 

• Examiner however in the liqiit of the Applicant's arguments with respect to 
the timing of the interception has withdrawn the rejections of the claims 4. 
12. 18 and 24. 



Claim Rejections - 35 USC § 102 



Application/Control Number: 09/607,430 Page 6 

Art Unit: 2132 

1. Claims 1-3, 5, 10-11, 16-17, 19 and 22-23 and 25 are rejected under 35 
U.S.C. 102(b) as being anticipated by Chen et al (5,832,208 A). 

Exanriiner refers Applicant to col .6, lines 58-63 where "e-mail messages" is being 
used to describe all types of files, messages, broadcasts and communications used 
within, sent from or received by a mail server. Therefore Examiner considers any 
reference to e-mail messages corresponds to incoming files of Applicant's claims 
limitations. As an example" scanning of all e-mail messages corresponds to 
scanning of all incoming files. 

Col. 5, lines 54-56 refer to centralized virus detection operations at the server level. 
Therefore Examiner considers any reference to e-mail server or other name server 
by Chen et al corresponds to "networked server" of Applicant's claim limitation. 

Col.6, lines 1-4 disclose that the system is capable of scanning all incoming files as 
they are received. 

As per claim 1 Chen et al (5,832,208 A) teach in a networked server (see fig.2, item 
130 where the mail server corresponds to networked server) having a file system, 
therein (see fig.2, item 140; col.7, lines 1 1-16 where the message system 
corresponds to applicant's file system), a virus detection monitoring system (see 
abstract where detection and removal of virus application in combination with server 
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network and peripheral devices and interfaces corresponds to Applicant's virus 
detection monitoring system that monitors incoming files for virus ) comprising: 

a) a check-in interceptor configured to monitor the network server for incoming files 
and intercept incoming files before said files are transferred to the file system of 
the server (see fig.2, item 1 10 where the agent corresponds to check-in 
interceptor; col. 7, lines 32-53 where the agent 110 monitors files for any type of 
attachment and fonA/ard the files to item 120 for virus detection and removal, the 
files do not transferred to the file system until the process of checking and re- 
attachment to the file are being processed) and 

b) an anti-virus interface operatively coupled to said check-in interceptor (see fig.2, 
item 1 10 where item 110 also corresponds to Applicant's anti-virus interface, that 
is the agent not only monitors the incoming files as an check in interceptor but it 
also act as an interface between the server and the antiviral application of 120; 
also see col. 7, lines 48-56 where upon detection of attachment it send the file to 
anti virus application), said anti-virus interface configured to transfer the incoming 
files, which are intercepted, to an anti-virus application for virus detection and 
removal (see col .7, lines 48-67 where if virus detected then the infected 
attachment is being deleted). 

As per claim 2 Chen et al (5,832,208 A) teach the virus detection monitoring system 
of claim 1 wherein said anti-virus interface is further configured to receive from said 
anti-virus application a signal indicating whether a virus was detected in the 
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intercepted incoming file and wliether the virus was removed (see col. 7, lines 57-67 
anti virus application send an alert indicating a detection of virus and delete the virus 
before being send a signal to the agent for scanning the next file as described in 
col. 8, lines 1-5) . 

As per claim 3 Chen et al (5,832,208 A) Chen et al teach the virus detection 
monitoring system of claim 1, wherein said check-in interceptor is further configured 
to prevent an intercepted incoming file from entering the file system if a virus is 
detected in the intercepted incoming file (see fig.2, item 110 where the agent 
corresponds to check-in interceptor; col .7, lines 32-53 where the agent 110 monitors 
files for any type of attachment and fonward the files to item 120 for virus detection 
and removal, the files do not transferred to the file system until the process of 
checking and re-attachment to the file are being processed and that represent the 
act of prevention). 

As per claim 5 Chen et al (5,832,208 A) teach the virus detection monitoring system 

\ 

of claim 1 wherein said anti-virus interface is further configured to receive from said 
anti-virus application a signal indicating whether a virus was detected in the 
intercepted incoming file (see col. 7, lines 57-67 anti virus application send an alert 
indicating a detection of virus and delete the virus before being send a signal to the 
agent for scanning the next file as described in col. 8, lines 1-5), said check-in 
interceptor further configured to communicate the signal to a user submitting the 
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intercepted incoming file (see col.7, lines 60-65 where the alert may be transmitted 
to network node originated the infected attachment that corresponds to the user who 
submitted the virus in the first place). 

As per claim 10 Chen et al (5,832,208 A) teach in a networked server (see fig.2, 
item 130 where the mail server corresponds to networked server) having a file 
system (see fig.2, item 140; col.7, lines 1 1-16 where the message system 
corresponds to applicant's file system) therein, a method for virus detection 
monitoring (see abstract where detection and removal of virus application in 
combination with server network and peripheral devices and interfaces corresponds 
to Applicant's virus detection monitoring system that monitors incoming files for 
virus) comprising: 

a) intercepting incoming files before the incoming files are transferred to the file 
system of the server (see fig.2, item 1 1 0 where the agent intercepts and check all 
incoming files; col.7, lines 32-53 where the agent 110 monitors files for any type of 
attachment and fonward the files to item 120 for virus detection and removal, the files 
do not transferred to the file system until the process of checking and re-attachment 
to the file are being processed); and 

b) transferring the incoming files which are intercepted to an anti-virus 
application for virus detection and removal (see col.7, lines 48-67 where if virus 
detected then the infected attachment is being deleted). 
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As per claim 11 Chen et al (5,832,208 A) teach the method of claim 10, further 
comprising preventing an intercepted incoming file from entering the files system if a 
virus is detected in the intercepted incoming file (see fig.2, item 1 10 where the agent 
corresponds to check-in interceptor; col.7, lines 32-53 where the agent 110 monitors 
files for any type of attachment and forward the files to item 120 for virus detection 
and removal, the files do not transferred to the file system until the process of 
checking and re-attachment to the file are being processed and that represent the 
act of prevention). 

As per claim 13 Chen et al (5,832,208 A) teach the method of claim 10, further 

comprising: 

a) receiving a signal from said anti-virus application, said signal indicating 
whether a virus was detected in the intercepted incoming file (see col.7, lines 57-67 
anti virus application send an alert indicating a detection of virus and delete the virus 
before being send a signal to the agent for scanning the next file as described in 
col. 8, lines 1-5); and 

b) communicating the signal to a user submitting the intercepted incoming file (see 
col.7, lines 60-65 where the alert may be transmitted to network node originated 
the infected attachment that corresponds to the user who submitted the virus in 
the first place). 
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As per claim 16 Chen et al (5,832,208 A) teach a program storage device readable 
by a machine (see fig.2, item 130 where the mail server corresponds to networked 
server that is a readable machine having storage device), tangibly embodying a 
program of instructions executable by the machine to perform a method for virus 
detection monitoring (see abstract where detection and removal of virus application 
in combination with server network and peripheral devices and interfaces 
corresponds to Applicant's virus detection monitoring system that monitors incoming 
files for virus), said method comprising: 

a) intercepting the incoming files before the files are transferred to a file system of a 
server (see fig.2, item 110 where the agent check-in all incoming files; col .7, lines 
32-53 where the agent 1 1 0 monitors files for any type of attachment and forward 
the files to item 120 for virus detection and removal, the files do not transfen-ed to 
the file system until the process of checking and re-attachment to the file are 
being processed); and 

b) transferring the incoming files which are intercepted to an anti-virus 
application for virus detection and removal (see col.7, lines 48-67 where if virus 
detected then the infected attachment is being deleted). 

As per claim 17 Chen et al (5,832,208 A) teach the program storage device of claim 
16, said method further comprising preventing an intercepted incoming file from 
entering the files system if a virus is detected in the intercepted incoming file (see 
fig.2, item 110 where the agent corresponds to check-in interceptor; col.7, lines 32- 
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53 where the agent 1 1 0 monitors files for any type of attachment and forward the 
files to item 120 for virus detection and removal, the files do not transferred to the file 
system until the process of checking and re-attachment to the file are being 
processed and that represent the act of prevention). 

As per claim 19 Chen et al (5,832,208 A) teach the program storage device of claim 
16, said method further comprising: 

a) receiving a signal from said anti-virus application, said signal indicating whether a 
virus was detected in the intercepted incoming file (see col.7, lines 57-67 anti 
virus application send an alert indicating a detection of virus and delete the virus 
before being send a signal to the agent for scanning the next file as described in 
col.8, lines 1-5); and 

b) communicating the signal to a user submitting the intercepted incoming file (see 
col.7, lines 60-65 where the alert may be transmitted to network node originated 
the infected attachment that corresponds to the user who submitted the virus in 
the first place). 

As per claim 22 Chen et al (5,832,208 A) teach in a networked server (see fig.2, 
item 130 where the mail server con-esponds to networked server) having a file 
system (see fig.2, item 140; col.7, lines 1 1-16 where the message system 
corresponds to applicant's file system) therein, a virus detection monitoring system 
(see abstract where detection and removal of virus application in combination with 
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server network and peripheral devices and interfaces corresponds to Applicant's 
virus detection monitoring system that monitors incoming files for virus) comprising: 

a) means for intercepting the incoming files before the incoming files are transferred 
to the file system of the server (see fig.2, item 110 where the agent corresponds 
to check-in interceptor as means for intercepting all incoming files; col,7, lines 32- 
53 where the agent 110 monitors files for any type of attachment and fonA/ard the 
files to item 120 for virus detection and removal, the files do not transferred to the 
file system until the process of checking and re-attachment to the file are being 
processed); and 

b) means for transferring the incoming files which are intercepted to an 
anti-virus application for virus detection and removal (see coL7, lines 48-67 where if 
virus detected then the infected attachment is being deleted and the means for 
transfer if the agent 1 1 0 of fig.2). 

As per claim 23 Chen et al (5,832,208 A) teach the virus detection monitoring 
system of claim 22, further comprising means for preventing an intercepted incoming 
file from entering the files system if a virus is detected in the intercepted incoming 
file (see fig.2, item 1 10 where the agent corresponds to check-in interceptor; col.7, 
lines 32-53 where the agent 110 monitors files for any type of attachment and 
forward the files to item 120 for virus detection and removal, the files do not 
transferred to the file system until the process of checking and re-attachment to the 
file are being processed and that represent the means of prevention). 
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As per claim 25 Chen et al (5,832,208 A) teach the virus detection monitoring 
system of claim 22, further comprising: 

a) means for receiving a signal from said anti-virus application, said signal 
indicating whether a virus was detected in the intercepted incoming file (see 
coL7, lines 57-67 anti virus application send an alert indicating a detection of 
virus and delete the virus before being send a signal to the agent for scanning 
the next file as described in col.8, lines 1-5 as the means of detection of virus 
and alert as means of receiving the signal); and 

b) means for communicating the signal to a user submitting the intercepted 
incoming file (see col .7, lines 60-65 where the alert may be transmitted to 
network node originated the infected attachment that corresponds to the user 
who submitted the virus in the first place). 

Claim Rejections - 35 USC § 103 

2. Claims 6, 14, 20 and 26 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Chen et al (5,832,208 A) in view of Hodges et al (6, 
269,456 B1). 

As per claim 6 Chen et al (5,832,208 A) teach all limitation of the claim as applied 
to claim 1 . above but do not explicitly disclose a "dat file updater and validater" 
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coupled to the anti-virus application, said dat file updater and validater configured to 
periodically download updated virus data, validate the updated virus data after 
download, and update said anti-virus application with said updated virus data after 
validating said virus data. However Hodges et al (6, 269,456 B1) disclose a "dat file 
updater and validater" coupled to the anti-virus application, said dat file updater and 
validater configured to periodically download updated virus data, validate the 
updated virus data after download, and update said anti-virus application with said 
updated virus data after validating said virus data (see col.7, lines 1-12 where the file 
virus_signature.dat that corresponds to Applicant's dat file updater and validater 
configured to periodically such as nnonthly, or weekly, daily or even hourly update 
the dat file and validate the new update by integrating the new signature into the file 
virus_signature.dat by anti virus application manufacturer). It would have been 
obvious to one of ordinary skilled in the art at the time the invention was made to 
utilize Hodges et al's automated updating and upgrading of antivirus application 
system in Chen^s anti virus detection system where every incoming file is being 
scanned by check in inceptor in order to provide the most up-to-date, or even up-to 
hour anti virus protection available. 

As per claim 14 Chen et al (5,832,208 A) teach all limitation of method of claim 10 
as applied above but do not explicitly disclose: 

a) periodically downloading updated virus data; 

b) validating the updated virus data; and 
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c) updating said anti-virus application with said updated virus data. 
However Hodges et a! (6, 269,456 B1) disclose periodically downloading updated 
virus data; validating the updated virus data; and updating said anti-virus application 
with said updated virus data (see col .7, lines 1-12 where the file virus_signature.dat 
that corresponds to Applicant's dat file updater and validater configured to 
periodically such as monthly, or weekly, daily or even hourly update the dat file and 
validate the new update by integrating the new signature into the file 
virus_signature.dat by anti virus application manufacturer). It would have been 
obvious to one of ordinary skilled in the art at the time the invention was made to 
utilize Hodges et al's automated updating and upgrading of antivirus application 
method in Chen's anti virus detection method where every incoming file is being 
scanned by check in inceptor in order to provide the most up-to-date, or even up-to 
hour anti virus protection available. 

As per claim 20 Chen et al (5,832,208 A) teach all limitation of the program storage 
device of claim 16 as applied above but not explicitly disclose: 

a) periodically downloading updated virus data; 

b) validating the updated virus data; and 

c) updating said anti-virus application with said updated virus data. 
However Hodges et al (6, 269,456 B1) disclose the program storage device for 
downloading updated virus data according to a periodically downloading updated 
virus data; validating the updated virus data; and updating said anti-virus application 
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with said updated virus data (see col .7, lines 1-12 where the file virus_signature.dat 
that corresponds to Applicant's dat file updater and validater configured to 
periodically such as nnonthly, or weekly, daily or even hourly update the dat file and 
validate the new update by integrating the new signature into the file 
virus_signature.dat by anti virus application manufacturer). It would have been 
obvious to one of ordinary skilled in the art at the time the invention was made to 
utilize Hodges et al's automated updating and upgrading of antivirus application 
virus detection program device for scanning incoming file by check in interceptor 
device in order to provide the most up-to-date, or even up-to hour anti virus 
protection available. 

As per claim 26 Chen et al (5,832,208 A) Chen et al (5,832,208 A) teach the virus 
detection monitoring system of claim 22, further comprising: 

a) means for downloading updated virus data according to a schedule; 

b) means for validating the updated virus data; and 

c) means for updating said anti-virus application with said updated virus data. 
However Hodges et al (6, 269,456 B1) disclose means for downloading updated 
virus data according to a schedule; means for validating the updated virus data; and 
means for updating said anti-virus application with said updated virus data (see 
col.7, lines 1-12 where the file virus_signature.dat that corresponds to Applicant's 
dat file updater and validater configured to periodically such as monthly, or weekly, 
daily or even hourly update the dat file and validate the new update by integrating 
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the new signature into the file virus_signature.dat by anti virus application 
manufacturer). It would have been obvious to one of ordinary skilled in the art at the 
time the invention was made to utilize Hodges et al's automated updating and 
upgrading of antivirus application means in Chen's anti virus detection means where 
every incoming file is being scanned by check in inceptor means in order to provide 
the most up-to-date, or even up-to hour anti virus protection available. 



3. Claims 7, 15, 21 and 27 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Chen et al (5,832,208 A) in view of McGrane (6,760,760 
B1). 

As per claims 7, 15, 21 and 27 Chen et al (5,832,208 A) teach all limitation of the 
claims including agent 1 1 of fig.2 that also corresponds to the virus detection 
monitoring system of claims 1,10, 16 and 22, but do not explicitly disclose said 
check-in interceptor inspects documents and files uploaded to an electronic 
document control system operating on the network server. However McGrane 
(6,760,760 B1) disclose uploaded of files to an electronic document control system 
operating on the network server (see fig.2-4 where the control system operating 
under the network server transfer uploaded data to the server; col .2, lines 61-63; 
col .4, lines 6-17 where it disclose a bi-directional communication and that the 
uploading of files are being send to the server where uploading may be in any 
direction). It also discloses more than one link between the server and the 
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controller). It would have been obvious to one of ordinary skilled in the art to link 
MacGrane's file controller system where the uploaded file is stored to Chen's agent 
1 1 of figure 2 that corresponds to check in interceptor in order to provide establish a 
pathway to one or more control systems to enable bi-directional transfer of uploaded 
data and files to be intercepted and scanned by Chen's anti virus interceptor agent. 

4. Claims 8 and 9 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Chen et al (5,832,208 A) in view of Tso et al (6,088,803 A). 

As per claims 8 and 9 Chen et al (5,832,208 A) teach all limitation of the claim as 
applied in claim 1 above but do not disclose the Interception of files comprising of 
uploaded commands and hypertext transfer protocol commands issued to the 
server. However Tso et al (6,088,803 A) disclose uploaded commands and 
hypertext transfer protocol commands issued to a server (see fig.5, item 36; col. 7, 
lines 13-23 where operation of read (uploading) and write (downloading) command 
for hypertext transfer protocol (http) is being processed where such file under that 
commands regardless of being uploaded or downloaded in any type of format such 
as html are subject to virus checker as disclosed on col. 3, lines 2-4). It would have 
been obvious to one of ordinary skilled in the art at the time the invention was made 
to utilize Tso et al's uploaded and HTTP commands in Chen's et al's anti-virus 
scanning file system in order to scan such internet downloaded/uploaded files for 



Application/Control Number: 09/607,430 Page 20 

Art Unit: 2132 

virus detection in order to prevent transmission of file and issuing an appropriate 
error warning message to client device or the server that holds the file. 

Allowable Subject Matter 

5. Claims 4, 12, 18 and 24 are objected to as being dependent upon a rejected 
base claim, but would be allowable if rewritten in independent form including 
all of the limitations of the base claim and any intervening claims. 

Conclusion 

6. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of 
time policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 
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7. Any inquiry concerning tliis connmunication or earlier communications from 
the examiner should be directed to Kambiz Zand whose telephone number is 
(571) 272-381 1 . The examiner can normally reached on Monday-Thursday 
(8:00-5:00). If attempts to reach the examiner by telephone are unsuccessful, 
the examiner's supervisor, Gilberto Barron can be reached on (571) 272- 
3799. The fax phone numbers for the organization where this application or 
proceeding is assigned as 571-272-8300. Information regarding the status of 
an application may be obtained from the Patent Application Information 
Retrieval (PAIR) system. Status information for published applications may be 
obtained from either Private PAIR or Public PAIR. Status information for 
unpublished applications is available through Private PAIR only. For more 
information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the 
Electronic Business Center (EBC) at 866-217-9197 (toll-free). 




Kambiz Zand 



11/28/2005 
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